This documentation is for the Envoy v3 API.

As of Envoy v1.18 the v2 API has been removed and is no longer supported.

If you are upgrading from v2 API config you may wish to view the v2 API documentation:

This extension may be referenced by the qualified name envoy.filters.http.router


This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.


This extension extends and can be used with the following extension category:

Router configuration overview.


[extensions.filters.http.router.v3.Router proto]

  "dynamic_stats": "{...}",
  "start_child_span": "...",
  "upstream_log": [],
  "suppress_envoy_headers": "...",
  "strict_check_headers": [],
  "respect_expected_rq_timeout": "...",
  "suppress_grpc_request_failure_code_stats": "..."

(BoolValue) Whether the router generates dynamic cluster statistics. Defaults to true. Can be disabled in high performance scenarios.


(bool) Whether to start a child span for egress routed calls. This can be useful in scenarios where other filters (auth, ratelimit, etc.) make outbound calls and have child spans rooted at the same ingress parent. Defaults to false.


(repeated config.accesslog.v3.AccessLog) Configuration for HTTP upstream logs emitted by the router. Upstream logs are configured in the same way as access logs, but each log entry represents an upstream request. Presuming retries are configured, multiple upstream requests may be made for each downstream (inbound) request.


(bool) Do not add any additional x-envoy- headers to requests or responses. This only affects the router filter generated *x-envoy-* headers, other Envoy filters and the HTTP connection manager may continue to set x-envoy- headers.


(repeated string) Specifies a list of HTTP headers to strictly validate. Envoy will reject a request and respond with HTTP status 400 if the request contains an invalid value for any of the headers listed in this field. Strict header checking is only supported for the following headers:

Value must be a ‘,’-delimited list (i.e. no spaces) of supported retry policy values:

Value must be an integer:


(bool) If not set, ingress Envoy will ignore x-envoy-expected-rq-timeout-ms header, populated by egress Envoy, when deriving timeout for upstream cluster.


(bool) If set, Envoy will avoid incrementing HTTP failure code stats on gRPC requests. This includes the individual status code value (e.g. upstream_rq_504) and group stats (e.g. upstream_rq_5xx). This field is useful if interested in relying only on the gRPC stats filter to define success and failure metrics for gRPC requests as not all failed gRPC requests charge HTTP status code metrics. See gRPC stats filter documentation for more details.